E-commerce has revolutionized how businesses sell to consumers — including those involved in illicit activities, such as websites peddling illegal narcotics, pirated movies and music, or counterfeit handbags. For example, 96 percent of Internet pharmacies do not comply with U.S. laws, and as they ship pills tainted with paint thinner, arsenic, and rat poison, they put the health and safety of consumers at risk. Why don't law enforcement officials do more to combat this problem? Partly because of the difficulty of identifying who is actually operating the illegal pharmacies. It is time to fix this, while allowing anonymity for those who deserve it.
One requirement for registering any website domain name is that the domain owner must provide its contact information. This information is placed into WHOIS, a public, online database. Some website owners choose to use a privacy and proxy service, which submits contact information for the service provider and is then responsible for relaying any inquiries to the actual registrant. Unfortunately, not all privacy and proxy services fulfill their duties, creating a serious problem for law enforcement agencies. For example, FTC Commissioner Julie Brill has noted "...even ICANN recognizes that the system is flawed, often allowing bad actors to hide behind incomplete, inaccurate, or proxy information."
Fortunately, many stakeholders have been working over the past few years to develop a proposal that would create more accountability for website owners. ICANN's Privacy and Proxy Services Accreditation Issues (PPSAI) Working Group, a group of volunteers committed to developing an accreditation process for service providers, released an initial report for public comment on May 5, 2015. The group sought feedback on when privacy and proxy services should be prohibited in domain name registrations, especially for e-commerce websites, and how to make it more difficult for actors engaged in illegal activity to hide behind them.
In response to the PPSAI's request for comment, the Electronic Frontier Foundation (EFF) launched a misleading campaign claiming that Internet users' privacy was under attack by law enforcement and "Big Hollywood." Specifically, Jeremy Malcolm at the EFF falsely claimed that the proposal would not allow commercial websites to use proxy services. But as the Motion Picture Association of America's Alex Deacon noted in a recent blog post, "This is misleading. In fact, the report explicitly states that 'the [working group] agreed that the mere fact that a domain name is registered by a commercial entity or by anyone conducting commercial activity should not preclude the use of [privacy and proxy] services.'"
While the PPSAI proposal does not call for restricting privacy and proxy services, that idea is worthy of additional discussion since there are clear precedents for establishing limitations on online anonymity. For example, the CAN-SPAM Act establishes requirements for sending commercial email messages, such as providing accurate and identifiable information about the sender and the sender's physical location. Limiting anonymity for commercial websites would actually increase the privacy of Internet users, since it would allow them to know who they are doing business with and avoid disreputable companies.
The PPSAI is still working out the methods by which it believes ICANN can achieve a more trustworthy Internet, but the working group's efforts are commendable. Its report does not advocate for either extreme position — total privacy or total transparency — but instead attempts to strike a balance between the two. The goal of the working group is not to take away privacy from political activists, domestic abuse victims, or others who may otherwise be exposed to harassment or threats from their online activities, but rather to fix a flawed domain registration system that criminals routinely exploit at the expense of their victims.
As this debate continues, the PPSAI should keep to the pragmatic center ground that it staked out in its initial report and not give in to extremists on either side. Balancing privacy and public safety is critical to create a more trustworthy Internet.
Written by Daniel Castro, VP at Information Technology and Innovation Foundation